VIRUS IN 1stPAGE 2000

[skyscanner]

VERY IMPORTANT !!!

I JUST DOWNLOADED 1STPAGE 2000, AND DURING THE INSTALLATION, NORTON ANTIVIRUS 2004 STOPPED A VIRUS:

C:\Program Files\Evrsoft\1stPage2000\Buttons\Six buttons from hell.izs

Even so, it affected my Internet acccess, blocking all attempts to access the web. I had to load an old copy of the registry.

Be very careful until this is sorted out.

Skyscanner

[tmmoose]

Not A Virus.......Javascript six bottons from hell....included with
1st. Page.not a virus......reported as a virus.....but it is not
Read the ......Sticky: READ BEFORE POSTING (Important)
at the top of each thread!!!

[skyscanner]

If it isn't a Virus, then Norton Antivirus2004 turns it into one, and people should still WATCH OUT !!

Sequence of events:
1/ Install 1st Page on my Win98SE with NAV2004.
2/ Norton blocks 1stPage\Buttons\Six buttons from hell.izs
3/ I lose my internet access: I can connect (tried 2 of my normal ISPs) but no data flows. Try Outlook Express, but no connection to any email server.
4/ I restored my old registry entry, and all back to normal again.


So, if it isn't a virus, it is still creating havoc. Do I uninstall my AntiVirus just to get 1stPage working ? (That's rhetorical, by the way). If it is already known about, why not just remove it ? Something fishy going on here!

Skyscanner

PS - the 'Sticky: READ BEFORE POSTING' *does* have a link in it to "HELP! There is a virus inside your program..." but clicking on it just brings up page :

http://developers.evrsoft.com/forum/announcement.php?s=&forumid=20#notice1

which has NO mention about a virus in it !!

[Daybreak_0]

skyscanner - why not go to Mcaffe or Nortons and look it up.

[skyscanner]

Well of COURSE I went to look it up, but the word was that it may have additional problems for newer versions. As the installation doesn't give you the chance to examine or refuse it, its generally better policy to be safe than sorry !

[SundayNiagara]

It's not a virus!

[dailen]

Do a little research for God's sake...even with what it does, it doesn't affect your internet access. Don't let you imagination get carried away with you, it's a simple bit of javascript and html that happens to have some fun with your computer. It does NOT affect any of the contents of your hard drive.

Norton tries to stop people from accessing it via the web so they don't get an unexpected surprise. It does NOTHING harmful to your computer whatsoever. PERIOD.

[Coreyp_1]

"Six Buttons..." only affects your computer if you intentionally run the script. In fact, I've used First Page since it came out (several years ago), and have never even deleted the "Six Buttons..." file from my computer.

Why?

BECAUSE IT DOESN'T HURT ANYTHING!

It's not a virus, either. Norton just has a limited vocabulary. It calls things a virus, worm, etc., but it does not have a section called "Stupid script that only hurts you if you intentionally run it," so it calls it a virus.

It would be like writing a program that gets stuck in an infinite loop. Norton would probably call it a virus, too, even though it is not self-propogating as a virus, by definition, is.

Clear as mud?

[sbroyles]

If it does damage when you run it, then it is a Virus by definition.
On installation my Nortons caught it and Quarantined it. It did no damage to my system and I have submitted it to Norton for review.

[Joe the Large]

A virus, by definition, is a program that replicates itself over and over and seeks to take over the host. "Six buttons from hell" is a javascript that spawns multiple windows in your browser (assuming you run the script) . It does not damage your browser, or your computer. It does
not replicate itself or take over your computer.
Is it a pain in the ass? YES
Is it dumber than a box of rocks? YES
Is it annoying as hell? YES
Is it a virus? NO
Hope that helps :rolleyes:

[dailen]

I don't consider something a virus that can be stopped by merely pressing CTRL-ALT-DEL and killing your browser process.

And btw, usually you only submit things to Norton for review that are actually undiscovered threats. Say for instance Norton stops a suspicious program but it doesn't know what it is, that's when you should submit it to Norton.

Norton is just going to delete your email anyway because the 6-Buttons From Hell is a nothing more than a prank...email them and ask them what it does to your system, I bet they'll tell you the same thing we are. Heck, try stopping your antivirus and look through the source code....it doesn't even LOOK harmful. Nothing about duplicating itself or deleting anything (I don't even think a javascript can delete files). Javascript is a harmless browser language it does NOTHING outside your browser. And even it's control inside the browser is limited...it's a weak language (on a system level) so how can you even THINK that a javascript could compromise your system?

[DCElliott]

"Six Buttons" is a script that spawns multiple windows and in the process can eat up computer resources to the point that a system will hang. At some point the virus scanner folks decided they didn't like it and labelled it a "virus" despite it not having any viral characteristics. This has propagated a great deal of hysteria on the behalf of the latest "victims" and a large amount of irritation on the part of forum members having to reassure persons posting "there's a virus..." messages.

There used to be a thread dealing with how to install 1st Page and then get rid of the sixbuttons script but the link appears to have been lost when the forums got reordered.

Here are a couple of sorry examples of the kind of discourse this has caused on these forums:
http://developers.evrsoft.com/forum/showthread.php?s=&threadid=913
http://developers.evrsoft.com/forum/showthread.php?s=&threadid=451&highlight=six+buttons+remove

And here are the definitive directions on how to remove it from an installation (Go down to David Bindel's post):
http://developers.evrsoft.com/forum/showthread.php?s=&postid=6270#post6270

If your AV program is causing a new installation to abort, you may safely turn it off during the installation and then follow the directions in Bindel's post. (And remember to turn on your AV program after ;))

DE

[BoogerBomb]

Before I install this program I want to know if this trojan/virus/donothingprogram or whatever it is classified as is still distributed with file.

It really sucks that that poor guy lost his laptop after going through what looks to be a real headache if you accidentally run it. The question was never answered, why did the developers decide to put in a program that would crash your computer?

At least you guys saved yourselves this headache by not including it in the new version of 1st page.

It would probably be a better program if people new to web desgining and such didnt have to clean up the program prior to or after instillation.

When you say its harmless imagine an organization making extensive use of this program and all consequent users checking it themselves and running the script. You end up using the tech support person just to go through all the computers just to clean them up so it doesn't happen again.

EverSoft isn't scoring good points by some of the responses I have seen to people that were affected by it. They should have cleaned up the free file immediately and posted an apology on the front page rather than letting other users jump down everyones throat who didnt know better thereby scaring away potential new customers as. I never saw the front page when all this happened but am assuming by all the commotion they never did anything about it.

[Daybreak_0]

Originally posted by BoogerBomb
all the stuff you said

For the sake of others that may read this thread and also not do any research.

a) 1st page was released with this script way before Anti virus programs in their wisdom decided it was a virus.

b) The Six buttons from hell is not a virus in by any definition that relates to a virus or Trojan for that matter.

I wonder if you guys have been just as critical of
Nortons?????????????????????? Are you asking them why their program classed the file as a virus when it clearly is not.

c) 1st page has not been changed/edited/patched since it was originally released. Nobody knows why tech support went very quiet.

A little bit of research would have revealed all of that.


Originally posted by BoogerBomb
It really sucks that that poor guy lost his laptop after going through what looks to be a real headache if you accidentally run it. The question was never answered, why did the developers decide to put in a program that would crash your computer?


Nortons, was the real culprit, a piece of software I no longer run due to the amount of times it has stuffed up my PC.

Day

[dailen]

I second that, Norton is actually just as unstable as most of the virus it protects people from. I. personally, prefer the corporate counterpart of Norton A/V...Symatec Corporate Antivirus...now that's a fine piece of software! McAfee is just as bad...I don't know what happen to these software lines but I don't trust any antivirus other than Symantec's...

[dabbler]

Just a note that:

We are users of the program, or previous users of it, not the developers/writers etc.

Only Admin can answer questions as to why it included, not removed etc. etc. etc.

Please don't rant at us for not answering questions when we are not responsible for that. We are a community of users, who have come together to try to help each other.

Questions regarding the program itself, other than: how do I.....? , should be directed to Admin. He set up this forum, he is the guy behind Evrsoft, he is the guy who occasionally turns up to make a comment.

I feel sad that this issue having been extensively covered in previous threads and explained in detail, still attracts approbrium to US as a community by those who have not read those Announcements marked "Please Read Before Posting".

My two penn'orth.

[tagsfan]

If someone is packaging code in their software that, when ran either by direct action by me or otherwise, causes my computer to do something that inconviences me, and does not tell me about it beforehand, that is not cool! OK, if it is not a virus by strict defination, it is at least malware and the developer was unwise to include it. I downloaded my software directly from Evrsoft, so I don't buy that someone included it after the fact. JS LOOP is just another example.

[Joe the Large]

I'm not even going to try this time.

[dabbler]

Why do we bother?

Please, Admin, if you ever re-surface, give a definitive answer individually to every enquirer. - It's the only answer.

[BoogerBomb]

Actually I already read some of the other threads regarding this and was just wondering what the reasoning was behind it and whether or not if it is still distributed to this date. Not once did I ever mention or complain that I got a virus from this program as the other threads made that clear.

I was already smart enough to not use Norton AV or McAfee. I am a cheap bastard and use AVG and have had no problems with it at all.

I guess I was just annoyed at the way everyone was saying its no big deal. Just put yourself into the shoes of someone who really didn't understand what was going on. Most of us are smart enough to know how to deal with it, but there are a ton of people out there that don't.

Well people make bad decisions and it just sucks that one of his was something that turned out this big. It will be a while before this dies as this is software that will always be available somewhere on the internet.

[Admin]

The warning you get from your virus scanner is nothing you should be worried about. The file is just simply a snippet in our Javascript collection that once a webmaster uses inside their webpage will attempt to crash a web browser. The Javascript collection was compiled in 1999-2000. It is my understanding that a lot of webmasters were playing pranks by adding this code to their webpages and then invited innocent visitors to their site in an attempt to crash their web browser. These users would of complained and reported this as a virus and thus it is now built into most virus scanners. Mind you a lot of virus scanners use the same virus defintition files and thus you get the warning. There is no need to be worried as it will do not harm to your computer, the worst thing that will happen is the script will attempt to open lots of windows in an attempt to crash your web browser forcing you to reboot. However, most of the computers we run these days can handle *a lot* of windows. Of course you would have to actually paste the script into your web page and then run it!


Originally posted by skyscanner
VERY IMPORTANT !!!

I JUST DOWNLOADED 1STPAGE 2000, AND DURING THE INSTALLATION, NORTON ANTIVIRUS 2004 STOPPED A VIRUS:

C:\Program Files\Evrsoft\1stPage2000\Buttons\Six buttons from hell.izs

Even so, it affected my Internet acccess, blocking all attempts to access the web. I had to load an old copy of the registry.

Be very careful until this is sorted out.

Skyscanner

[xxx]

I downloaded 1st Page and I followed the directions of how to exorcise six buttons from hell. It worked perfectly. So, if you want to download the old version of Evrsoft's great program and try it out, just follow the directions and you will not crash your machine, cause thick black smoke to pour out of your wall socket, imperil your eternal soul, or bring about the downfall of your local 4H club.

Actually, I am poised to download the new and (what appears to be wonderful) version when it comes out. Really looks like a worldbeater.

[interpret]

I have used Evrsoft for several years now. Recently I had to reformat and install Windows XP due to some Trojans that infected my computer. I went ahead and purchased the Norton Antivirus and Firewall.

While redownloading 1stPage Norton definitely *said* it detected a virus. That doesn't make 1stpage bad, and I don't know enough to say whether Norton was wrong in declaring it to be a virus. I do know that it caught something before it reached my computer. I will still use 1stpage cuz it's great and it's free.

Conclusion: 1stPage is awesome and I recommend it. But until it makes clear to everyone that it sends out unappreciated crap with the program or makes the program clean, I will let everyone know that it does send out what Norton calls a virus.

Again, this says nothing about the greatness of the software. It is truly great. But it is EVRSOFT's responsibility to get rid of it, not to blame something on Norton. Plain and simple.

[pascal]

Why is that file in the programm anyway?

(almost) All virus-scanners say it is a virus, and it is a JavaScript that let you browser crash or something.
Why is it there??

I think it scares the **** out of people who have never heard of the programm bevore.
When i donwloaded 1stpage, MC Afee just deleted the file, not that that bothers me. :D

Having your virus scanner saying there is a virus, is not what you want when you download a programm, you see.

[KriTenKs]

Well, when fp2000 first came out, it wasnt defined as a virus. it was just a stupid little javascript and a good laugh. A prank! how can it affect anything apart from your browser

[DCElliott]

It is simply not practical to try to get all the copies of 1st page with the offending script off the net and replace them with a new installer without the six-buttons script. A search (http://www.google.ca/search?num=20&hl=en&ie=UTF-8&oe=utf-8&safe=off&q=1stpage2+OR+1stpage2000&btnG=Google+Search&meta=) will turn up over 1800 copies out there for downloading.

DE

[azlatin2000]

Originally posted by dailen

Norton is just going to delete your email anyway because the 6-Buttons From Hell is a nothing more than a prank...email them and ask them what it does to your system, I bet they'll tell you the same thing we are. Heck, try stopping your antivirus and look through the source code....it doesn't even LOOK harmful. Nothing about duplicating itself or deleting anything (I don't even think a javascript can delete files). Javascript is a harmless browser language it does NOTHING outside your browser. And even it's control inside the browser is limited...it's a weak language (on a system level) so how can you even THINK that a javascript could compromise your system?

In internet explorer you can use activex controls (or infectivex controls cause they allow spyware to infect your computer) to delete and create files and directories. In Mozilla there is something similar but i don't know what it is. You can also just create a .js file and run it and it won't even warn you about it trying to do anything to your filesystem. If you know very advanced javascript like i do it is not very weak.